Minecraft Forums

Ok First off i'm not going to sit here and bash the people that made the FTB launcher what your doing is good work and i respect each and every one of you fully however... i feel i must bring this to your attention and i'm sorry i know i will catch some hell for this and again i'm not in anyway disrespecting FTB its dev's or modder's or any such silly thing that is poping in your heads
1. third party software asking for account info in any way sends up a nasty red flag to some players never mind the the *pureness* in your hearts or whatever its the very first and basic rule of internet gaming you never ever give out your account info to third party software unless that software has the full express premission of that software company and can legally back up that claim and i'm pretty sure its breaking Mojang's EULA but again i'm not sure i'm not a full legal expert on the subject i can contact Mojang's staff directly if this will help the matter but again please reconsider removing that account login because even if it goe's to mojang it still pass's through your servers and database's first unless you can prove otherwise in the code that it does not do such but bottom line is this
1. please remove that from your program to help ease others minds and to follow the golden rule of internet gaming or.
2. please provide proof that mojang's has given consent that you may have user's log in using your application before hand or.
3. please provide proof that our account info goe's directly to mojang's server and in no way shape or form pass's through another gateway database login server databank or anything of such that follows .

Again I Repeat I'm Not Disrespecting Anyone At All Here I'm Just Trying Settle Some Things For Not Only Me But For Other's Out There That May See Handing Over Our Account Info To A Third Party Software Abit Off Putting To Say The Least And If You Do Happen To Send Me Hate And Nasty Comments Then You Did Not Read Fully Or You Read But Lack The Ability To Understand The Content

Thank You For Reading

Quote from Ujimar

you can prove otherwise in the code that it does not do such

The launcher is open source, feel free to verify the code.

https://github.com/Slowpoke101/FTBLaunch

Quote from toddc76

My opinion on this is that it IS disrespectful.

If you don't want to use the launcher because YOU feel its unsafe, THEN DON'T. Other launchers do it and LOTS of people use them. The FTB launcher is being assisted by the dev of the most popular launcher out there.



This too! Posts like the OP here makes me angry.. grrrr..

I really don't feel i was being disrespectful to anyone like i say you may not be able to understand the content of what i was talking about which is ok and i will look at the code i know its open source but i also no that if it went to directly to mojang's server they would have to have some type of agreement or something in place that states that FTB is a working third party software group that has full legal consent to do such and i do know that much or are you going to make me bust out my bar lin number.... for proof on that matter at least

Hey there, you will get absolutely no flak from me with regards to this point. I consider this to be a perfectly legitimate question. So to answer it, can I say that in the design of the code I had very specific guidelines laid down to the team with regards to this. We have actually gone several steps beyond what you are asking for.

So as to what you ask for, we are looking at number 3 being our answer. Our launcher connects directly to the mojang servers.
(the relevent information for those that understand it is here.)
https://github.com/S...oginWorker.java
and this is called by
https://github.com/S...aunchFrame.java
(on line 347, to show that the information is only stored locally)

However we know that 99% of people will not understand what they are looking at. So in between the beta and going live, the entire code will be checked and analysed By Lex Manos from Forge. He has been asked to verify that the code is safe and free from anything nasty. He will then provide the launcher with a digital signature, verifying this.

Furthermore whilst the launcher is custom built, it is an entirely open source piece of software. It is free for anyone to download and check that there is nothing malicious contained within. Extending on from this, The Launcher does not just cater to FTB packs and maps but also to third party packs, maps and texture packs. Every single one of these will be verified in house and checked for potential problems. Does this mean we will guarantee the integrity of the pack, this is a different manner as I am not sure if that is even possible. However I can promise you that every effort has been and will continue to be made to ensure the security of your accounts and your PC's.

Hopefully this will help to answer some of the questions you may have.

Quote from toddc76

I understand exactly what you are saying, I just disagree. I know that might be difficult for you to understand that someone might disagree with you, but there it is.

no no you have a right to disagree fully i support that much at least but i don't think you can take my right by saying i cannot disagree or have a different point of view without being branded disrespectful or any such none sense as i'm sure i'll hear from many of fanboys which is ok with me if they can fully understand where i am coming from and people like me and can talk in a mature manner towards the subject

Quote from slowpoke

Hey there, you will get absolutely no flak from me with regards to this point. I consider this to be a perfectly legitimate question. So to answer it, can I say that in the design of the code I had very specific guidelines laid down to the team with regards to this. We have actually gone several steps beyond what you are asking for.

So as to what you ask for, we are looking at number 3 being our answer. Our launcher connects directly to the mojang servers.
(the relevent information for those that understand it is here.)
https://github.com/S...oginWorker.java
and this is called by
https://github.com/S...aunchFrame.java
(on line 347, to show that the information is only stored locally)

However we know that 99% of people will not understand what they are looking at. So in between the beta and going live, the entire code will be checked and analysed By Lex Manos from Forge. He has been asked to verify that the code is safe and free from anything nasty. He will then provide the launcher with a digital signature, verifying this.

Furthermore whilst the launcher is custom built, it is an entirely open source piece of software. It is free for anyone to download and check that there is nothing malicious contained within. Extending on from this, The Launcher does not just cater to FTB packs and maps but also to third party packs, maps and texture packs. Every single one of these will be verified in house and checked for potential problems. Does this mean we will guarantee the integrity of the pack, this is a different manner as I am not sure if that is even possible. However I can promise you that every effort has been and will continue to be made to ensure the security of your accounts and your PC's.

Hopefully this will help to answer some of the questions you may have.

I Understand What Your Saying And I Have Checked The Code Personally And No I Have Found No Such Issue's With It This Date And Time However As I'm Sure Your Aware Java Code Can How To Say This Bluntly But Without To Much Of Me Sounding Rude As Far As Security Measure's Go Java Is Lacking A Good Bit You Could Agree On This Much I'm Sure But Again I Will Consider The Pack Even If I'm Abit *Cautious* About Third Party Software Thank You For Your Time And Your Mature View Point On This Topic Also

You are more than welcome. Please feel free to make whatever choice you feel comfortable with.

What is the legality in regards to downloading the minecraft.jar files and the lwjgl.jar etc files from minecraft servers. I've emailed Mojang about it and they have personally told me not to do it and that they don't like it.

Quote from RyanTheAllmighty

What is the legality in regards to downloading the minecraft.jar files and the lwjgl.jar etc files from minecraft servers. I've emailed Mojang about it and they have personally told me not to do it and that they don't like it.

It only downloads the files if the account is verified by Mojang. So they have to have a premium account to be able to download the minecraft files. Other launchers do this as well, MultiMC included. (If I recall correctly)

Quote from RyanTheAllmighty

What is the legality in regards to downloading the minecraft.jar files and the lwjgl.jar etc files from minecraft servers. I've emailed Mojang about it and they have personally told me not to do it and that they don't like it.

Quote from unv_annihilator

It only downloads the files if the account is verified by Mojang. So they have to have a premium account to be able to download the minecraft files. Other launchers do this as well, MultiMC included. (If I recall correctly)

It's just the same as if you went into minecraft and force updated it to re-download your minecraft.jar

Quote from unv_annihilator

It only downloads the files if the account is verified by Mojang. So they have to have a premium account to be able to download the minecraft files. Other launchers do this as well, MultiMC included. (If I recall correctly)

Okay yeah I understand that much Is that not breaking Mojang's TOS as I have been told by Mojang that it shouldn't be done, unless they are refering to downloading them from unverified accounts. I've been through there TOS and Brand Guidelines before and while it makes no mention of it, I've always been a bit iffy about the legality of it. Thats why I thought I might ask and someone can actually answer it but can never get a straight direct answer :\

Wrong section buddy try posting here http://www.minecraftforum.net/forum/2-discussion/

As I'm Sure Your Aware Java Code Can How To Say This Bluntly But Without To Much Of Me Sounding Rude As Far As Security Measure's Go Java Is Lacking A Good Bit You Could Agree On This Much I'm Sure

You have no idea what you're talking about; Java is no less secure than any other programming language, and has more support for it than most others.

I have 15 years experience writing Java professionally; I've examined the code and verified it does nothing with the account information that would be surprising or malicious.

Quote from Crawford42

You have no idea what you're talking about; Java is no less secure than any other programming language, and has more support for it than most others.

I have 15 years experience writing Java professionally; I've examined the code and verified it does nothing with the account information that would be surprising or malicious.

I guess the people at forbes don't know what they're talking about either huh:
http://www.forbes.com/sites/andygreenberg/2012/08/31/oracles-java-security-woes-mount-as-researchers-spot-a-bug-in-its-critical-bug-fix/

Or these people:
http://www.informationweek.com/security/application-security/java-vulnerability-affects-1-billion-plu/240007985

Or these:
http://appleinsider.com/articles/12/08/30/oracle_issues_patch_for_latest_java_security_flaw.html

Quote from Crawford42

You have no idea what you're talking about; Java is no less secure than any other programming language, and has more support for it than most others.

I have 15 years experience writing Java professionally; I've examined the code and verified it does nothing with the account information that would be surprising or malicious.

Quote from Crawford42

You have no idea what you're talking about; Java is no less secure than any other programming language, and has more support for it than most others.

I have 15 years experience writing Java professionally; I've examined the code and verified it does nothing with the account information that would be surprising or malicious.

15 years huh? and your saying nothing can be done to that code to get the info?.. honestly i do think your full of it when you make such a blunt statement unless you can prove otherwise i'm going to call you a liar sir because java is very much less secure then other programming language's only a half wit would state otherwise or someone that has no idea about programming in general

Quote from patzh

I was wondering, how many mods are in the current beta version and when is the finished product expected to go live?

'0
I know that without a doubt, that the finished product comes out sometime after 1.4.2 However, if you want to check out the 1.4.2 beta you can watch a video, courtesy of Direwolf20, with him playing with many of the same mods ( such as Thaumcraft 3) that are still in beta and will appear in the modpack itself'.

I think if over 20 modders gave personal consent to the creators of FTB, you can trust them.